Most users don’t/can’t verify hash signatures or detached GPG signatures – even some new Linux users struggle. Putting aside the trust issue of a central certification authority this is a massive step towards usability and security. The benefit of Windows for most users is that the installers are almost always digitally signed nowadays. Sometimes Windows is essential for your job so I can’t blame Bruce for needing to use Windows 10. O&O ShutUp10 is a great piece of free software, no install required, that allows you to reign back your privacy. There are more but they’re the main ones I can think off the top of my head. *in XTS-AES-256 mode with a 256-bit recovery key (NOT the numeric recovery password which only has 128 bits of entropy!) Using strong anti-virus (perhaps in a default-deny configuration)

Keeping it up-to-date (deferred upgrades if necessary security patches still received) Have a password protected screensaver just in case Limiting interactive login (too many incorrect attempts will force BitLocker recovery)ĭisabling update sharing (i.e. Using BitLocker with pre-boot authentication (DMA ports are now locked by default) Protecting the UEFI firmware (any changes will kick BitLocker into recovery mode) Using BitlLocker with TPM and PIN (or even TPM + PIN + USB)* Aug6:04 10 can be hardened but it’s tricky.

Best anti malware windows 10 reddit